hi,
I think that this will have to help you.
You should initially count all the values of Group1 and Group2, then to make a division.
grou1: |eval action=if(field1="value1", "group1", if(field2="value2", "group2", action))| where action="goup1"| stats c by action as GROUP1
group2: |eval action=if(field1="value1", "group1", if(field2="value2", "group2", action))| where action="goup2"| stats c by action as GROUP2
division eval Division=GROUP1/GROUP2]
General solution: |eval action=if(field1="value1", "group1", if(field2="value2", "group2", action))| where action="goup1"| stats c by action as GROUP1|appencolds [search ...|eval action=if(field1="value1", "group1", if(field2="value2", "group2", action))| where action="goup2"|stats c by action as GROUP2]| eval Division=GROUP1/GROUP2
... View more